Live › vulnerability › CVE-2026-89229
The ShareActivity component of the vivo BlueLM Copilot app (com.vivo.ai.copilot) does not restrict file names supplied through a ContentProvider, so '..' sequences escape the intended directory. A malicious app installed on the same phone can send a crafted share intent and write arbitrary files into the Copilot app's reachable storage.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 10:20 UTC. All times on this page are UTC.
Owners of vivo phones with the BlueLM Copilot app installed who also have other apps installed that could be malicious; the flaw needs a second app on the same device to send the crafted intent. Sources do not state which BlueLM Copilot versions are affected or fixed.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the same device to write arbitrary files via a crafted ACTION_SEND intent with a ContentProvider-supplied file name containing '..' sequences.
This page as .md · .json · in your agent: get_signal("CVE-2026-89229")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.